Advisories

Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Go Back
severity
medium
date
Affecting
  • Rocket.Chat >= 0, < 7.10.15

  • Rocket.Chat >= 8.0.0, < 8.1.8

  • Rocket.Chat >= 8.2.0, < 8.2.8

  • Rocket.Chat >= 8.3.0, < 8.3.8

  • Rocket.Chat >= 8.4.0, < 8.4.6

  • Rocket.Chat >= 8.5.0, < 8.5.3

  • Rocket.Chat >= 8.6.0, < 8.6.2

  • Rocket.Chat >= 8.7.0, < 8.7.2

  • Rocket.Chat >= 8.8.0-rc.0, < 8.8.0

CWE
  • CWE-307 Improper Restriction of Excessive Authentication Attempts
  • CWE-204 Observable Response Discrepancy
CVSS
6.9
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Credit
nedlir
Description
Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.